playrote.play.v1

ppsohi-labs/polygraphv0.0.11Public

Polygraph

Your agent says it fetched the data.

Read the full description

This checks whether it did, scoring what it CLAIMED against what OSV, World Bank and USGS actually returned. On the run this was built from, a bluffing claim set failed 4 of 5 checks while still passing the one figure that happened to be true - it scores per claim, not per agent. Four checks: call reality, pagination exhaustion (claiming complete after 1 of 6 World Bank pages reaches 50 of 265 rows), citation retention, and error surfacing (a deliberately malformed query returns HTTP 400 - reported, or swallowed?). Five steps: four independent source reads in parallel, one join. A source that goes down degrades to a labeled unknown and the run still completes; an indeterminate check is never a pass. Read-only against every source: anonymous public reads, no credential, nothing written back. Its only local effect is writing polygraph.html into out_dir, creating that directory if it does not exist; out_dir defaults to the run workspace. Needs only python3 3.9 or newer.

oosv
  • Published 3 Sep 2026
  • Downloads 8
  • Needs rote 0.62.0+
  • Digest sha256:9c4d7739fd89…
  • Reference psohi-labs/polygraph@0.0.11

Before you run it1 service, 1 local tool

Everything here is checked on your machine when rote inspects the play. This page never learns what you have installed or which credentials you hold.

  • ○
    osv

    osv adapter

    No credential needed
  • ○
    python3local tool

    Requires >=3.9. Run rote play inspect to check your host; unverified versions remain unknown.

Inputs12, all optional

rote asks for these before running and shows the defaults it will use.

  • Package namepackage_name

    Package name for the OSV vulnerability lookup (OSV package.name)

    optionalstringdefault djangocustom value allowed
  • Package ecosystempackage_ecosystem

    OSV ecosystem for the package, e.g. PyPI, npm, Go (OSV package.ecosystem)

    optionalstringdefault PyPIcustom value allowed
  • Package versionpackage_version

    Exact package version to query (OSV version)

    optionalstringdefault 3.0.0custom value allowed
  • Wb indicatorwb_indicator

    World Bank indicator code; its response envelope is the pagination fixture

    optionalstringdefault SP.POP.TOTLcustom value allowed
  • Wb datewb_date

    World Bank observation year (date query parameter)

    optionalstringdefault 2020custom value allowed
  • Wb per pagewb_per_page

    Rows per World Bank page; smaller values make the pagination gap wider

    optionalstringdefault 50custom value allowed
  • Usgs starttimeusgs_starttime

    USGS FDSNWS starttime, ISO-8601. A fixed past window is what makes the count reproducible

    optionalstringdefault 2026-08-01custom value allowed
  • Usgs endtimeusgs_endtime

    USGS FDSNWS endtime, ISO-8601

    optionalstringdefault 2026-08-02custom value allowed
  • Usgs min magnitudeusgs_min_magnitude

    USGS FDSNWS minmagnitude floor

    optionalstringdefault 4.5custom value allowed
  • Claims fileclaims_file

    Absolute path to a JSON object of the answers your harness CLAIMED. Empty scores the bundled demo claim set instead

    optionalstringcustom value allowed
  • Out dirout_dir

    Directory to write the HTML verdict page into. Empty writes polygraph.html into the run workspace

    optionalstringcustom value allowed
  • Open pageopen_page

    never leaves the page on disk, auto opens it in your default browser after the run

    optionalstringdefault nevercustom value allowed

What it changes

No write operations are declared in this version's manifest.

Credentials remain in the recipient's local rote vault; this page and the publisher never receive them.

Runtime details
  • rote CLIversion 0.62.0 or newer
  • Servicesosv
  • Adapters
    osv psohi-labs/osv@1.0.0 resolved
  • Digestsha256:9c4d7739fd896ce54feb3b5c52f8f52e1140feaccaa05b92974a815d27d6f62a
  • Archive size16982 bytes
  • Published2026-09-03T23:59:55.925557+00:00
  • Published withrote 0.79.0

Credential values and current readiness remain local. Opening this page never prompts for a credential, opens an authorization browser, or calls a service this play uses.

A play is a published, versioned automation package that runs on your own machine through rote, a free command-line tool. Opening this page installs nothing and runs nothing.